feat(api): bind encrypted workspaces to accounts and devices

server/src/WebDrop.Core/Envelope.cs

@@ -17,7 +17,7 @@ public readonly record struct Envelope(FrameFlags Flags, Id16 ItemId, uint Frame
         if (data.Length < HeaderSize || data[0] != Version) return false;
 
         byte flags = data[1];
-        if ((flags & 0xF0) != 0) return false;
+        if ((flags & 0xE0) != 0) return false;
 
         uint payloadLen = BinaryPrimitives.ReadUInt32BigEndian(data[22..]);
         if (payloadLen > int.MaxValue || data.Length != HeaderSize + (int)payloadLen) return false;
@@ -34,9 +34,10 @@ public readonly record struct Envelope(FrameFlags Flags, Id16 ItemId, uint Frame
     public bool IsGated => (Flags & FrameFlags.Gated) != 0;
     public bool IsSnapshot => (Flags & FrameFlags.Snapshot) != 0;
     public bool IsEnc => (Flags & FrameFlags.Enc) != 0;
+    public bool IsControl => (Flags & FrameFlags.Control) != 0;
 
     /// <summary>条目级标志:同一条目的所有帧必须一致。</summary>
-    public FrameFlags ItemFlags => Flags & (FrameFlags.Snapshot | FrameFlags.Gated);
+    public FrameFlags ItemFlags => Flags & (FrameFlags.Snapshot | FrameFlags.Gated | FrameFlags.Control);
 }
 
 public static class PayloadTiers